CVE-2026-58656

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Referrer headers can create persistent backdoor super-admin accounts and exfiltrate sensitive configuration and user data.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/getgrav/grav/security/advisories/GHSA-hqm9-5xxw-4qxp
https://www.vulncheck.com/advisories/grav-api-plugin-cross-origin-admin-account-takeover-via-cors-wildcard-and-jwt-query-parameter
https://github.com/getgrav/grav/security/advisories/GHSA-hqm9-5xxw-4qxp

Configurations

No configuration.

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El plugin de API de Grav anterior a la v1.0.0-rc.16 acepta tokens JWT a través del parámetro de consulta URL ?token= y responde con Access-Control-Allow-Origin: *, permitiendo a atacantes no autenticados realizar solicitudes de API de origen cruzado completamente autenticadas desde cualquier sitio web malicioso. Atacantes que obtienen un token JWT filtrado de registros de acceso, registros de proxy, historial del navegador o encabezados Referrer pueden crear cuentas de superadministrador persistentes con puerta trasera y exfiltrar datos sensibles de configuración y de usuario.

Information

Published : 2026-07-08 14:17

Updated : 2026-10-25 20:10

NVD link : CVE-2026-58656

Mitre link : CVE-2026-58656

CVE.ORG link : CVE-2026-58656

JSON object : View

Products Affected

No product.

CWE

CWE-598

Use of HTTP Request With Sensitive Query String

{"id": "CVE-2026-58656", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58656", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T15:44:29.470827Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.0-rc.15"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-08T14:17:20.297", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-hqm9-5xxw-4qxp", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/grav-api-plugin-cross-origin-admin-account-takeover-via-cors-wildcard-and-jwt-query-parameter", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-hqm9-5xxw-4qxp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-598"}]}], "descriptions": [{"lang": "en", "value": "Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Referrer headers can create persistent backdoor super-admin accounts and exfiltrate sensitive configuration and user data."}, {"lang": "es", "value": "El plugin de API de Grav anterior a la v1.0.0-rc.16 acepta tokens JWT a trav\u00e9s del par\u00e1metro de consulta URL ?token= y responde con Access-Control-Allow-Origin: *, permitiendo a atacantes no autenticados realizar solicitudes de API de origen cruzado completamente autenticadas desde cualquier sitio web malicioso. Atacantes que obtienen un token JWT filtrado de registros de acceso, registros de proxy, historial del navegador o encabezados Referrer pueden crear cuentas de superadministrador persistentes con puerta trasera y exfiltrar datos sensibles de configuraci\u00f3n y de usuario."}], "lastModified": "2026-10-25T20:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}